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Dear Ms. Seymour: 

This letter is in response to your public records request received in the Attorney 
General’s Office on August 28, 2019, in which you sought records pursuant to the Public 
Records Act as set forth in Government Code section 6250 et seq. 

Below, please find your specific requests followed by our office’s response: 

1. “Any and all records reflecting the establishment, legal authorization, or permission to 
use, test, or evaluate CURES 2.0 (e.g., statutes concerning its use, training manuals); 

Response to 1: We would like to direct you to Article 1 of Chapter 4 of Division 10 of the 
Health and Safety Code, which is publicly available, here: 

http://leginfo.legislature.ca.gov/faces/codes.xhtml . The California Department of Justice 
(Department) does not have any other responsive records for this request. 

2. Any and all memoranda of understanding between the State Board of Pharmacy and 
any outside entity regarding the CURES 2.0; 

Response to 2: The Department does not have responsive records for this request. 

3. Any and all records including information about the algorithm that determines risk 
scores in the CURES 2.0, including but not limited to its source code, developer 
documentation, and operator manuals; 

Response to 3: We are interpreting “risk scores” to mean patient alerts, prescriber alerts, 
and pharmacy alerts. With regard to source codes, the Department does not have responsive 
records. With regard to other information about the algorithm that determines risk scores, the 
records are exempt under Government Code section 6254, subdivision (f). The risk scores 
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determined by an algorithm in the Controlled Substance Utilization Review and Evaluation 
System (CURES) are investigatory records compiled for law enforcement and regulatory 
purposes. Disclosure of this information about how those determinations are made might prove 
disruptive to current or future investigations because individuals could use the information to 
attempt to avoid detection through CURES. For the same reasons, the public interest in 
disclosure of the algorithms are outweighed by the public interest in non-disclosure. (Gov. Code, 
§ 6255.) 

4. Any and all research, technical reports, or internal audits that evaluate the CURES 2.0 
risk assessment tool’s effectiveness or performance; 

Response to 4: The Department does not have any additional non-exempt responsive 
records for this request aside from those already disclosed in response to your March 7, 2019 
request. If you would like another copy of those records, let us know and we will provide those 
to you. 


Some records responsive to this request are exempt under Government Code section 
6254, subdivision (f). Disclosure of this information might prove disruptive to current or future 
investigations because individuals could use the information to attempt to avoid detection 
through CURES. For the same reasons, the public interest in disclosure of the algorithms are 
outweighed by the public interest in non-disclosure. (Gov. Code, § 6255.) 

5. Any record showing the number ofpatients in the CURES 2.0 by quarter and year 
(2006-present); 

Response to 5: Pursuant to Health and Safety Code 11165(c)(2)(A), CURES data shall 
only be provided to appropriate state, local, and federal public agencies for disciplinary, civil, or 
criminal purposes. The Department may also provide information to other agencies or entities 
for educational, peer review, statistical, or research purposes, provided that patient information, 
including information that may identify the patient, is not compromised. If records are being 
requested for research purposes, requestors may initiate a data request with the Office of the 
Attorney General Data Center online, here: https://oag.ca.gov/research-center/request-process . 
Otherwise, we must decline to disclose CURES data in response to this request. 

6. Any and all records showing how often law enforcement entities or individuals have 
requested information or records from the CURES 2.0, or made electronic queries of the 
system, including but not limited to what types of information or records have been 
requested, which agencies have made the requests, the percent of requests that were 
accepted versus denied, temporal trends, the form of the request (e.g. subpoena, warrant, 
etc.), and whether the requests were granted or denied. ” 

Response to 6: CURES 2.0 is a database of Schedule 11, Ill and IV controlled substance 
prescriptions dispensed in California serving the public health, regulatory oversight agencies, 
and law enforcement. Accordingly, queries made into CURES by law enforcement entities are 
exempt as investigatory records under Government Code, section 6254, subdivision (f) as 
disclosure of this information might prove disruptive to current or future investigations, and 
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could reveal certain investigative patterns and techniques of these agencies. Moreover, this 
section expressly exempts from disclosure investigatory and security files of law enforcement 
agencies. (See, Dick Williams v. Superior Court (1993) 5 Cal.4th 337, 354.) Communications 
made via CURES in pursuit of an agency's law enforcement mission would be investigatory 
records and are thus exempt under subdivision (f). 

Furthermore, the disclosure of records showing how often agencies or individuals seek 
their own records from CURES is outweighed by the public interest in creating a secure database 
for the exclusive use of law enforcement, public health and regulatory oversight agencies and to 
access information like that available in CURES. Thus, it is being withheld under Government 
Code section 6255, subdivision (a). 

Some records you have requested are exempt under Government Code section 6254, 
subd. (k) because they are subject to attorney client privilege. The attorney-client privilege 
contained in Evidence Code section 954 protects confidential communications between an 
attorney and his or her client and are expressly incorporated into the Public Records Act. (Gov. 
Code, § 6254, subd. (k); Roberts v. City of Palmdale (1993) 5 Cal.4th 363.) To the extent your 
request encompasses such communications, they are exempt from disclosure under the Public 
Records Act. 

Some records you have requested are also exempt as attorney work product. The 
attorney work product exception protects the confidentiality of any writing that reflects an 
attorney’s impressions, conclusions, opinions, legal research or legal theories that is maintained 
as confidential. This confidentiality provision is incorporated into the Public Records Act as an 
exemption from disclosure. (Gov. Code, § 6254, subd (k); County of Los Angeles v. Superior 
Court (2000) 82 Cal.App.4th 819, 833.) To the extent your request encompasses records such as 
confidential analyses, draft language, and memoranda prepared by the attorneys employed with 
the Attorney General’s Office relating to CURES access, these documents are subject to the 
work product exception and are exempt from disclosure under the Public Records Act. 


Sincerely, 



JAIMIE TACKETT 
Manager 


For XAVIER BECERRA 
Attorney General 








